He found that a big swath of companies that belong to the Network Advertising Initiative continue to collect data about users after they opt out of behavioral advertising. That in itself probably shouldn't be surprising, given that self-regulatory standards allow companies to continue to gather data about users who opt out, as long as those companies don't serve them targeted ads.
But whether that should be the case is up for debate. The NAI itself says that these companies often need the data for operational purposes, frequency capping and the like. But privacy advocates, as well as some regulators and lawmakers, are calling on companies to stop collecting information about people who opt out. One reason is that people who opt out presumably don't want information about themselves compiled; that concern doesn't go away simply because ad networks stop serving targeted ads to users.
What's more troubling about the Stanford report is that Mayer found that eight networks -- 24/7 Real Media, Adconion, AudienceScience, Netmining, Undertone, Vibrant Media, Wall Street on Demand and TARGUSinfo Advisor -- appear to have broader privacy policies than industry standards require, but also appear to violate those policies by collecting data, or failing to delete cookies, after users opt out.
Not all of those companies agree with the report. Vibrant Media tells MediaPost that it doesn't collect data from users who opt out of behavioral advertising; the company says it also intends to delete user ID cookies after people opt out. AudienceScience tells MediaPost that cookies that remain on users' computers only contain time stamps, and not any information about Web activity.
But some of the other companies named in the report have acknowledged that their privacy policies were ambiguous. Since Tuesday, at least three ad networks have rewritten those policies to better reflect their practices.
That in itself raises questions, including why the ad networks weren't more careful with their privacy-policy language to begin with. It's not as if online ad companies aren't aware that they're under scrutiny these days. While it might be difficult to explain behavioral advertising and cookies in plain English, surely ad networks could have come up with clear and accurate descriptions of their data practices before now.